image signing
also: container image signing, code signing (images), image verification
Image signing is the process of cryptographically signing container or disk images to verify their authenticity and ensure they haven't been tampered with. It uses digital signatures to prove that an image comes from a trusted source.
Image signing creates a digital signature for a container image or virtual machine image using a private key. When someone pulls or deploys that image, they can verify the signature with the corresponding public key to confirm the image is authentic and hasn't been modified.
This is especially critical for container images. Tools like docker trust, podman, and cosign support signing. For example, you might sign a Docker image with: cosign sign --key cosign.key myregistry.io/myapp:v1.0
Verification ensures that the image you're running is exactly what the publisher created. Without signing, an attacker could replace a legitimate image in a registry with malicious code, and users would have no way to detect the compromise.